EUVD-2026-35485
GHSA-5m8f-m8jv-3rp3
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (CNA) · only source for this CVE.
CVSS VectorVendor
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5Description PRE-NVD
AnalysisAI
Bleichenbacher oracle in OpenSSL's CMS_decrypt() and PKCS7_decrypt() functions exposes RSA-encrypted message content to unauthenticated remote attackers who can submit adaptive chosen-ciphertext queries against multi-RecipientInfo CMS/PKCS7 structures. Four active OpenSSL branches are affected (3.4.x, 3.5.x, 3.6.x, and 4.0.x), with patches released under the coordinated OpenSSL security advisory on 2026-06-09. No public exploit code and no active exploitation have been identified at time of analysis; SSVC rates this non-automatable with partial technical impact, consistent with the attack's high operational complexity.
Technical ContextAI
The vulnerability resides in OpenSSL's RSA key-transport decryption path within CMS (Cryptographic Message Syntax) and PKCS#7 message processing, specifically triggered by messages carrying multiple RecipientInfo entries. CWE-514 (Covert Channel) identifies the root cause: the implementation leaks information about RSA PKCS#1 v1.5 padding validation outcomes through distinguishable behavioral differences in its error handling, creating a Bleichenbacher-style oracle - an adaptive chosen-ciphertext attack technique first published by Daniel Bleichenbacher in 1998. By repeatedly submitting crafted RSA ciphertexts and observing the binary pass/fail responses from the decryption oracle, an adversary can progressively recover plaintext key material. Affected CPE spans OpenSSL 3.4.0-3.4.5, 3.5.0-3.5.6, 3.6.0-3.6.2, and 4.0.0 per EUVD-2026-35485. The multi-RecipientInfo context (where a single CMS envelope may be addressed to multiple RSA recipients) is the specific code path that introduces the distinguishable oracle behavior.
RemediationAI
Upgrade to the vendor-released patched versions: OpenSSL 4.0.1 for the 4.0.x branch, 3.6.3 for 3.6.x, 3.5.7 for 3.5.x, or 3.4.6 for 3.4.x, as specified in the vendor advisory at https://openssl-library.org/news/secadv/20260609.txt. Ubuntu users should apply the package update provided in USN-8414-1 via standard apt package management. As a compensating control where patching cannot be applied immediately, restrict network access to any service invoking CMS_decrypt() or PKCS7_decrypt() on multi-RecipientInfo content to explicitly trusted source IPs or internal networks only, which reduces an attacker's ability to submit the large adaptive query volume the Bleichenbacher attack requires; note this does not eliminate the vulnerability and does not protect against internal threat actors. Applications that exclusively use ECDH-based CMS RecipientInfo and never invoke RSA key-transport paths are not affected and require no action.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today